{"id":"ASB-A-273995284","details":"In avdt_msg_ind of avdt_msg.cc, there is a possible memory corruption due to type confusion. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-273995284","CVE-2025-22435"],"modified":"2026-05-22T15:55:21.353668239Z","published":"2025-04-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-04-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/efa5f4ef386a8947f4777840c5cefff389740e86"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-04-01"}]}],"versions":["15-next"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6012433653b2770ddb67f5d6e9042e8ff6f8d66c","https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ca504bbacbdb2478cf18103c28ca39915bc352f6"],"vanir_signatures":[{"id":"ASB-A-273995284-12dafa76","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ca504bbacbdb2478cf18103c28ca39915bc352f6","signature_type":"Function","target":{"function":"avdt_msg_ind","file":"system/stack/avdt/avdt_msg.cc"},"signature_version":"v1","digest":{"function_hash":"17364776682207328621562279625673091583","length":3934},"deprecated":false},{"id":"ASB-A-273995284-42699ed1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6012433653b2770ddb67f5d6e9042e8ff6f8d66c","signature_type":"Line","signature_version":"v1","target":{"file":"system/stack/avdt/avdt_msg.cc"},"digest":{"threshold":0.9,"line_hashes":["69968497529221303174354349176262428972","289267339819583124441987779324406424110","210875894870981578955181235640352806598","232881515703603029002002586106176935855","298765360413203219284747084932649921103"]},"deprecated":false},{"id":"ASB-A-273995284-bfe867b2","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/6012433653b2770ddb67f5d6e9042e8ff6f8d66c","signature_type":"Function","target":{"function":"avdt_msg_ind","file":"system/stack/avdt/avdt_msg.cc"},"signature_version":"v1","digest":{"function_hash":"101213322258309175509044928261249359797","length":3611},"deprecated":false},{"id":"ASB-A-273995284-f994d855","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ca504bbacbdb2478cf18103c28ca39915bc352f6","signature_type":"Line","target":{"file":"system/stack/avdt/avdt_msg.cc"},"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["291121899986190632954558531092622720636","145485880068509586563865574044950578055","236604861184405476897001877115365783460","162556421373855455052121016183079354238","283785321425543417081153347573944754301","314592963219822661814482431325513627637","213375627068001655805525833708755971092","60345347931178594599383642155093729954","232881515703603029002002586106176935855"]},"deprecated":false}],"spl":"2025-04-01","severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-273995284.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-04-01"}]}],"versions":["15"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/80c094a66067efc42837cb8da445de4c3f5b637f"],"spl":"2025-04-01","vanir_signatures":[{"id":"ASB-A-273995284-9293aa9c","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/80c094a66067efc42837cb8da445de4c3f5b637f","signature_type":"Function","target":{"function":"avdt_msg_ind","file":"system/stack/avdt/avdt_msg.cc"},"signature_version":"v1","digest":{"function_hash":"101213322258309175509044928261249359797","length":3611},"deprecated":false},{"id":"ASB-A-273995284-b98f9140","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/80c094a66067efc42837cb8da445de4c3f5b637f","signature_type":"Line","target":{"file":"system/stack/avdt/avdt_msg.cc"},"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["289267339819583124441987779324406424110","210875894870981578955181235640352806598","232881515703603029002002586106176935855","298765360413203219284747084932649921103"]},"deprecated":false}],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-273995284.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-04-01"}]}],"versions":["13"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/359bdee195ff58652663b2721e966b2604a93f94"],"spl":"2025-04-01","vanir_signatures":[{"id":"ASB-A-273995284-4914368b","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/359bdee195ff58652663b2721e966b2604a93f94","signature_type":"Function","signature_version":"v1","target":{"function":"avdt_msg_ind","file":"system/stack/avdt/avdt_msg.cc"},"digest":{"function_hash":"275031440224446623701712737192977390752","length":3591},"deprecated":false},{"id":"ASB-A-273995284-a54c81d4","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/359bdee195ff58652663b2721e966b2604a93f94","signature_type":"Line","target":{"file":"system/stack/avdt/avdt_msg.cc"},"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["289267339819583124441987779324406424110","210875894870981578955181235640352806598","127072241333684706305506437777635863312","96166965579290052119536940010839083498"]},"deprecated":false}],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-273995284.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-04-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/359bdee195ff58652663b2721e966b2604a93f94"],"spl":"2025-04-01","vanir_signatures":[{"id":"ASB-A-273995284-111d86fe","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/359bdee195ff58652663b2721e966b2604a93f94","signature_type":"Line","target":{"file":"system/stack/avdt/avdt_msg.cc"},"signature_version":"v1","digest":{"threshold":0.9,"line_hashes":["289267339819583124441987779324406424110","210875894870981578955181235640352806598","127072241333684706305506437777635863312","96166965579290052119536940010839083498"]},"deprecated":false},{"id":"ASB-A-273995284-5397f643","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/359bdee195ff58652663b2721e966b2604a93f94","signature_type":"Function","target":{"function":"avdt_msg_ind","file":"system/stack/avdt/avdt_msg.cc"},"signature_version":"v1","digest":{"function_hash":"275031440224446623701712737192977390752","length":3591},"deprecated":false}],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-273995284.json"}}],"schema_version":"1.7.5"}